Privacy, competition, consumer and civil-rights records involving Meta’s Facebook, Instagram, WhatsApp and advertising systems.
The Commission found that Meta’s binary model required Facebook and Instagram users either to consent to combining personal data for personalised advertising or pay for an ad-free service. It did not offer the less-personalised but otherwise equivalent service required by the Digital Markets Act.
View caseA Facebook design flaw allowed attackers to obtain access tokens affecting about 29 million accounts. The regulator found failures in breach notification, documentation and data protection by design.
View caseThe Commission found that Meta tied Facebook Marketplace to Facebook, giving the classified-ads service a distribution advantage that competitors could not match. It also found that Meta imposed unfair conditions allowing it to use advertising data generated by rival classified-ad providers for Marketplace’s benefit.
View caseMeta notified the regulator that some social-media user passwords had been stored in plaintext on internal systems. The inquiry assessed notification, documentation and security obligations.
View caseTexas alleged that Facebook’s former Tag Suggestions feature captured facial geometry from photographs without the disclosures and consent required by state biometric-privacy law. The state brought the first case under its Capture or Use of Biometric Identifier Act.
View caseThe CMA investigated whether Meta could use data from businesses advertising on its platforms to gain an unfair advantage when developing and improving products that competed with those businesses, including Facebook Marketplace.
View caseThe EDPB found an ongoing infringement involving processing for behavioural advertising on the basis of contract and legitimate interests across the European Economic Area.
View caseThe Irish regulator found that Meta Ireland continued transferring Facebook users’ personal data to the United States without safeguards that addressed the risks identified by the Court of Justice of the EU.
View caseThe inquiry followed the publication of a dataset containing Facebook users’ personal data that had been scraped from the service. The DPC examined whether Facebook Search, Messenger Contact Importer and Instagram Contact Importer had been designed and configured in line with data-protection-by-design and default requirements.
View caseThe inquiry examined Instagram settings and the public disclosure of email addresses and phone numbers belonging to child users, including users of business accounts.
View caseThe Justice Department alleged that Meta’s housing-ad system discriminated in who received advertisements based on race, colour, religion, sex, disability, family status and national origin. The case addressed both advertiser targeting options and the effects of Meta’s delivery algorithms.
View caseThe DPC examined twelve Facebook data-breach notifications received during a six-month period in 2018. It found that Meta Platforms Ireland failed to put appropriate technical and organisational measures in place that would allow it to readily demonstrate how it protected EU users’ data in the context of those breaches.
View caseDuring its review of Facebook’s acquisition of Giphy, the CMA found repeated failures to comply with an initial enforcement order intended to keep the businesses separate while the merger was investigated. The failures included inadequate compliance reporting and changing a compliance officer without prior consent.
View caseCNIL found that visitors to facebook.com in France could accept cookies immediately but could not refuse them with comparable ease. Refusal required several additional actions, which the authority found affected users’ freedom of consent.
View caseThe DPC investigated how WhatsApp Ireland explained its processing to users and non-users, including the information it provided about data shared between WhatsApp and other Facebook companies. The European Data Protection Board resolved objections among supervisory authorities and instructed the DPC to reassess the proposed fine.
View caseThe FTC alleged that Facebook violated a 2012 privacy order by misleading users about control over their personal information and the handling of facial-recognition settings and phone numbers.
View caseDuring the 2014 review of Facebook’s WhatsApp acquisition, Facebook told the Commission that reliable automated matching of Facebook and WhatsApp user identities could not be established. The Commission later found that technical matching was possible in 2014 and that relevant staff were aware of that possibility.
View case